The present invention relates to an arrangement for the reliable detection of process states within freely couplable units, each controlled by a computer, the arrangement employing signal current loops and check tests. The computers are to be suitable for redundant operation, i.e. it should be possible to couple them together without the computers influencing one another.
According to a basic principle of control technology, safety monitoring is performed in a residual current process. For this purpose, a signal current loop is formed. Any interruption of the current is interpreted as a malfunction and causes, for example, a relay to trip, thus giving a signal and possibly causing the system to be switched off.
For units to be coupled together, which may, for example, be vehicles such as train cars, signal loops are conducted through all vehicles to ensure safety. All emergency switches or emergency brake switches or door locks or coupling contacts, etc. in the form of separate loops may be connected in series in such a circuit. The current is fed in and returned to, for example, the driver's cab. If one of these process switches is thrown, the vehicle is stopped.
In a group of vehicles which may be a variable number of different vehicles, often without their own driver's cabs, feed problems exist, particularly in redundant systems where the computer of one vehicle is to take over the control functions for another and in which, for the proper operation of the entire system (e.g. a train), when there is a malfunction in one vehicle, all vehicle units operate in parallel.
In failsafe computer systems which are relied upon to give the proper signals the proper operation of the computer must be additionally monitorable by constant tests and it must be possible to uncouple (separate) it from the process. For this purpose, it is known to control a loop extending through several vehicles from only one computer. If this computer switches the process off, for example in order to make on-line tests to check the system, there no longer is any process information. If the other vehicles also have their own computer on board, the signals from the other computers are at least interfered with and the compilation of data is impaired. Another drawback is that only the controlling computer is able to perform on-line tests.